add delta sync before each reconcile, have it not repeat if it's been done in the last minute

server.go

@@ -9,6 +9,7 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"sync"
 )
 
 // User is the subset of an ST user record this worker cares about.
@@ -53,6 +54,7 @@ type Server struct {
 	eligible map[string]bool
 	// runTimeout caps a single reconcile.
 	runTimeout time.Duration
+	syncMu     sync.Mutex
 }
 
 func NewServer(st STClient, store Store, secret string, eligible map[string]bool) *Server {